Bug #63829 [Opn->Nab]: Apache stack overflow on PCRE subpatterns

Edit report at https://bugs.php.net/bug.php?id=63829&edit=1 ID: 63829 Updated by: felipe@php.net Reported by: ab@php.net Summary: Apache stack overflow on PCRE subpatterns -Status: Open +Status: Not a bug Type: Bug Package: PCRE related Operating System: Windows PHP Version: Irrelevant Block user comment: N Private report: N New Comment: This has been already discussed: http://marc.info/?l=php-internals&m=121811425119001 Previous Comments: ------------------------------------------------------------------------ [2012-12-21 16:28:56] ab@php.net It seems to me more like strictly related apache+pcre under windows issue, as i read here http://lxr.php.net/xref/PHP_5_4/ext/pcre/pcrelib/pcre_exec.c#232 . CLI isn't affected by this. After defining #define NO_RECURSE 1 in pcrelib/config.h the issue disappears. The phpt tests pass. I'm not sure whether this would cause a big performance penalty, this should be tested. ------------------------------------------------------------------------ [2012-12-21 16:18:29] ab@php.net Description: ------------ Running the test ext/pcre/tests/bug47662.phpt under Apache 2.2 or 2.4 causes the CRT error with the following message: Unhandled exception at 0x01E3FC19 (php5ts_debug.dll) in httpd.exe: 0xC00000FD: Stack overflow (parameters: 0x00000001, 0x03CE2948). This error seems to have been existed for a very long time. It happens not only with the pcre ext lately upgraded to 8.31, but also with previous version using PCRE 8.12 . It also happens in both release and debug builds. Here is the backtrace delivered by VS ........................... a lot of match(...) calls ..................... php5ts_debug.dll!match(const unsigned char * eptr, const unsigned char * ecode, const unsigned char * mstart, int offset_top, match_data * md, eptrblock * eptrb, unsigned int rdepth) Line 956 C php5ts_debug.dll!match(const unsigned char * eptr, const unsigned char * ecode, const unsigned char * mstart, int offset_top, match_data * md, eptrblock * eptrb, unsigned int rdepth) Line 956 C php5ts_debug.dll!match(const unsigned char * eptr, const unsigned char * ecode, const unsigned char * mstart, int offset_top, match_data * md, eptrblock * eptrb, unsigned int rdepth) Line 956 C php5ts_debug.dll!match(const unsigned char * eptr, const unsigned char * ecode, const unsigned char * mstart, int offset_top, match_data * md, eptrblock * eptrb, unsigned int rdepth) Line 956 C php5ts_debug.dll!match(const unsigned char * eptr, const unsigned char * ecode, const unsigned char * mstart, int offset_top, match_data * md, eptrblock * eptrb, unsigned int rdepth) Line 956 C php5ts_debug.dll!php_pcre_exec(const real_pcre * argument_re, const pcre_extra * extra_data, const char * subject, int length, int start_offset, int options, int * offsets, int offsetcount) Line 6917 C php5ts_debug.dll!php_pcre_match_impl(pcre_cache_entry * pce, char * subject, int subject_len, _zval_struct * return_value, _zval_struct * subpats, int global, int use_flags, long flags, long start_offset, void * * * tsrm_ls) Line 653 C php5ts_debug.dll!php_do_pcre_match(int ht, _zval_struct * return_value, _zval_struct * * return_value_ptr, _zval_struct * this_ptr, int return_value_used, void * * * tsrm_ls, int global) Line 547 C php5ts_debug.dll!zif_preg_match(int ht, _zval_struct * return_value, _zval_struct * * return_value_ptr, _zval_struct * this_ptr, int return_value_used, void * * * tsrm_ls) Line 798 C php5ts_debug.dll!zend_do_fcall_common_helper_SPEC(_zend_execute_data * execute_data, void * * * tsrm_ls) Line 642 C php5ts_debug.dll!ZEND_DO_FCALL_SPEC_CONST_HANDLER(_zend_execute_data * execute_data, void * * * tsrm_ls) Line 2236 C php5ts_debug.dll!execute(_zend_op_array * op_array, void * * * tsrm_ls) Line 410 C php5ts_debug.dll!zend_execute_scripts(int type, void * * * tsrm_ls, _zval_struct * * retval, int file_count, ...) Line 1309 C php5ts_debug.dll!php_execute_script(_zend_file_handle * primary_file, void * * * tsrm_ls) Line 2482 C php5apache2_2.dll!php_handler(request_rec * r) Line 667 C Test script: --------------- $regex = '@'; for($bar=0; $bar<4027; $bar++) { $regex .= '((?P<x' . $bar . '>))'; } $regex .= 'fo+bar@'; var_dump(preg_match($regex, 'foobar', $m)); Expected result: ---------------- int(1) Actual result: -------------- An exception is thrown. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=63829&edit=1